BUSINESS ASSOCIATE AGREEMENT meant — Clinical Documentation Services This Business Associate Agreement ("Agreement") is entered into by and between: Covered Entity: ______________________________________________ Address: _____________________________________________________ Authorized signer / title: ___________________________________ Business Associate: meant — Clinical Documentation Services Contact: support@meant.com Effective date: ____________________ 1. PURPOSE AND BACKGROUND Covered Entity is a home health agency or other covered entity under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, "HIPAA"). Business Associate provides a clinical documentation service that helps clinicians draft visit notes and OASIS comment text from material the clinician supplies (dictation, rough bullets, photographs of the clinician's own handwritten worksheets, and consented visit audio recordings). The service is designed to operate WITHOUT protected health information ("PHI"). Clinicians are instructed not to submit patient identifiers. To the extent any PHI is nonetheless created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity, this Agreement governs it. 2. DEFINITIONS Terms used but not otherwise defined in this Agreement have the meaning given to them in 45 C.F.R. Parts 160 and 164 (the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules). 3. PERMITTED USES AND DISCLOSURES 3.1 Business Associate may use or disclose PHI only (a) to perform the documentation services requested by Covered Entity or its workforce members, (b) for Business Associate's proper management and administration, (c) to carry out its legal responsibilities, and (d) as Required By Law. 3.2 Business Associate will not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity. 3.3 Business Associate will not use or disclose PHI for marketing, will not sell PHI, and will not use PHI to train general-purpose machine-learning models for any other customer or purpose. 3.4 Business Associate will make reasonable efforts to use, disclose, and request only the minimum necessary PHI. 4. SAFEGUARDS Business Associate will use appropriate administrative, physical, and technical safeguards, and will comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, including: (a) encryption of data in transit (TLS) and at rest; (b) access limited to the individual clinician account that created the record, enforced at the database level by row-level security; (c) automatic deletion of saved notes, visit recordings, and transcripts thirty (30) days after they are created; (d) no retention of submitted photographs or original source material after the note is produced; (e) unique user accounts with password authentication and no shared logins; (f) audit logging of note-creation and document-send activity. 5. SUBCONTRACTORS Business Associate will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to restrictions and conditions at least as protective as those in this Agreement. Business Associate's current infrastructure and model subprocessors are disclosed in the Security Overview provided with this Agreement and will be updated on request. 6. INDIVIDUAL RIGHTS Because the service is designed to operate without patient identifiers, Business Associate does not maintain a Designated Record Set. To the extent it does hold PHI in a Designated Record Set, Business Associate will, within ten (10) business days of a written request from Covered Entity, make such PHI available so that Covered Entity may meet its obligations under 45 C.F.R. 164.524 (access), 164.526 (amendment), and 164.528 (accounting of disclosures). 7. REPORTING AND BREACH NOTIFICATION Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this Agreement, any Security Incident involving electronic PHI, and any Breach of Unsecured PHI, without unreasonable delay and in no case later than ten (10) calendar days after discovery. The report will include the information reasonably available to Business Associate under 45 C.F.R. 164.410(c). 8. ACCESS BY THE SECRETARY Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with HIPAA. 9. TERM AND TERMINATION 9.1 This Agreement takes effect on the effective date above and continues until all PHI is returned or destroyed, or protections are extended as described in Section 9.3. 9.2 Covered Entity may terminate this Agreement and the underlying service immediately upon a material breach by Business Associate that is not cured within thirty (30) days of written notice. 9.3 Upon termination, Business Associate will return or destroy all PHI it maintains, if feasible. Where return or destruction is not feasible, Business Associate will extend the protections of this Agreement to that PHI and limit further uses and disclosures to those purposes that make return or destruction infeasible. Saved notes, recordings, and transcripts are in all cases deleted automatically thirty (30) days after creation. 10. MISCELLANEOUS 10.1 A reference to a section of HIPAA means that section as in effect or as amended. 10.2 The parties agree to amend this Agreement as necessary for compliance with HIPAA. 10.3 Any ambiguity in this Agreement will be resolved in favor of a meaning that permits compliance with HIPAA. 10.4 This Agreement does not create any third-party beneficiary rights. SIGNATURES Covered Entity Signature: _________________________________ Date: ____________ Printed name: ______________________________ Title: _____________________________________ Business Associate — meant, Clinical Documentation Services Signature: _________________________________ Date: ____________ Printed name: ______________________________ Title: _____________________________________ This document is a template provided for your review. Have your own counsel or compliance officer review it before signing.