Business Associate Agreement

This Business Associate Agreement ("Agreement") is entered into by and between Elderwise.ai ("Covered Entity") and _____________ ("Business Associate") as of the date last signed below (the "Effective Date").

1. Definitions

Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the HIPAA Rules.

• "Protected Health Information" (PHI) means any information transmitted or maintained in any form or medium that identifies or could be used to identify an individual and relates to their health condition, provision of healthcare, or payment for healthcare.
• "Security Incident" means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.
• "Breach" means the acquisition, access, use, or disclosure of PHI in a manner not permitted under the HIPAA Privacy Rule.

2. Obligations and Activities of Business Associate

Business Associate agrees to:

• Not use or disclose PHI other than as permitted or required by this Agreement or as required by law;
• Use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this Agreement;
• Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI;
• Report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware;
• Report to Covered Entity any Security Incident of which it becomes aware;
• Ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions and conditions;
• Make available PHI in accordance with the individual's rights under HIPAA;
• Maintain and make available the information required to provide an accounting of disclosures;
• Make its internal practices, books, and records available to the Secretary of HHS for purposes of determining compliance with HIPAA Rules.

3. Permitted Uses and Disclosures

Business Associate may use or disclose PHI only as follows:

• As necessary to perform the services outlined in the underlying service agreement;
• For the proper management and administration of Business Associate;
• As required by law;
• For data aggregation purposes for the healthcare operations of Covered Entity.

4. Breach Notification

Business Associate shall notify Covered Entity without unreasonable delay and in no case later than 60 days after discovery of a Breach of Unsecured PHI. Such notification shall include:

• The identification of each individual affected by the Breach;
• A description of what happened, including date of Breach and date of discovery;
• The types of PHI involved;
• Steps individuals should take to protect themselves from potential harm;
• A description of what Business Associate is doing to investigate, mitigate harm, and protect against future Breaches;
• Contact procedures for individuals to ask questions.

5. Term and Termination

6. Indemnification

Business Associate agrees to indemnify and hold harmless Covered Entity from and against any claim, cause of action, liability, damage, cost, or expense, including attorneys' fees and costs, arising out of or relating to any acts or omissions of Business Associate in connection with Business Associate's obligations under this Agreement.

7. General Provisions

• This Agreement shall be governed by the laws of the state in which Covered Entity is located.
• Any ambiguity shall be resolved to permit Covered Entity to comply with HIPAA Rules.
• This Agreement supersedes any prior agreements between the parties regarding PHI.
• This Agreement may only be amended in writing signed by both parties.