Business Associate Agreement

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (this "Agreement") is entered into by and between:

Business Associate: TrustedPsych, LLC, an Arizona limited liability company, with a notice address at 4539 N 22nd St #7488, Phoenix, Arizona 85016 ("Business Associate" or "TrustedPsych"); and

Covered Entity: the individual or practice identified in the signature block below ("Covered Entity").

Business Associate and Covered Entity are referred to individually as a "Party" and collectively as the "Parties."

Effective Date: the date of the last signature below.

RECITALS

A. Covered Entity is a health care provider that conducts one or more standard transactions electronically and is therefore a "covered entity" as defined under the HIPAA Rules.

B. Business Associate provides Covered Entity with electronic health record, scheduling, documentation, billing, client portal, and related practice management services (the "Services") pursuant to the TrustedPsych Terms of Service and any related participation agreement governing Covered Entity's use of the Services (together, the "Underlying Agreement").

C. In performing the Services, Business Associate will create, receive, maintain, or transmit Protected Health Information on behalf of Covered Entity and is therefore a "business associate" as defined under the HIPAA Rules.

D. The HIPAA Rules require the Parties to enter into a written agreement containing satisfactory assurances that Business Associate will appropriately safeguard Protected Health Information.

E. The Parties wish to comply with those requirements and to define the permitted and required uses and disclosures of Protected Health Information by Business Associate.

NOW, THEREFORE, in consideration of the mutual promises below and the exchange of information pursuant to this Agreement, the Parties agree as follows.

1. DEFINITIONS

1.1 Terms defined in the HIPAA Rules. Capitalized terms used but not otherwise defined in this Agreement have the meaning given to them in the HIPAA Rules, including without limitation the terms Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

1.2 Specific definitions.

(a) "Business Associate" means TrustedPsych, LLC and has the meaning given to the term "business associate" at 45 CFR 160.103.

(b) "Covered Entity" means the individual clinician or professional practice identified in the signature block and has the meaning given to the term "covered entity" at 45 CFR 160.103.

(c) "De-Identified Data" means health information that has been de-identified in accordance with 45 CFR 164.514(b) and that, as a result, does not identify an Individual and provides no reasonable basis to believe it can be used to identify an Individual.

(d) "Electronic Protected Health Information" or "ePHI" has the meaning given at 45 CFR 160.103, limited to information created, received, maintained, or transmitted by Business Associate from or on behalf of Covered Entity.

(e) "HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164, as amended by the Health Information Technology for Economic and Clinical Health Act (Pub. L. 111-5, Title XIII) and its implementing regulations, together with any subsequent amendments.

(f) "Machine Learning Model" means any artificial intelligence system, machine learning model, or algorithm whose parameters, weights, embeddings, or indices are derived from input data, including any fine-tuning, retrieval index, or embedding store built from such data.

(g) "PHI" means Protected Health Information created, received, maintained, or transmitted by Business Associate from or on behalf of Covered Entity.

(h) "Psychotherapy Notes" has the meaning given at 45 CFR 164.501.

(i) "Security Rule" means the Security Standards for the Protection of Electronic Protected Health Information at 45 CFR Part 160 and Part 164, Subparts A and C.

(j) "Services" has the meaning given in Recital B.

(k) "Subcontractor" means a person or entity to whom Business Associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of Business Associate, and who creates, receives, maintains, or transmits PHI on behalf of Business Associate.

2. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE

2.1 Limits on use and disclosure. Business Associate shall not Use or Disclose PHI other than as permitted or required by this Agreement, as permitted by the Underlying Agreement to the extent consistent with this Agreement, or as Required By Law.

2.2 Safeguards. Business Associate shall use appropriate administrative, physical, and technical safeguards, and shall comply with Subpart C of 45 CFR Part 164 with respect to ePHI, to prevent Use or Disclosure of PHI other than as provided for by this Agreement. Business Associate shall implement and maintain, at a minimum, the security measures described in Appendix A.

2.3 Minimum necessary. Business Associate shall limit its Uses, Disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose, consistent with 45 CFR 164.502(b) and 164.514(d).

2.4 Mitigation. Business Associate shall mitigate, to the extent practicable, any harmful effect known to Business Associate of a Use or Disclosure of PHI by Business Associate in violation of this Agreement.

2.5 Reporting.

(a) Impermissible use or disclosure. Business Associate shall report to Covered Entity any Use or Disclosure of PHI not permitted by this Agreement of which it becomes aware, without unreasonable delay and in no case later than twenty (20) business days after discovery.

(b) Breach of Unsecured PHI. Business Associate shall notify Covered Entity of any Breach of Unsecured PHI without unreasonable delay and in no case later than ten (10) business days after discovery of the Breach. A Breach is treated as discovered on the first day on which it is known to Business Associate, or by exercising reasonable diligence would have been known, to any person other than the individual committing the Breach who is an employee, officer, or agent of Business Associate.

(c) Contents of the notice. To the extent known at the time of notice, and thereafter promptly as further information becomes available, Business Associate's notification shall include:

1. a brief description of what happened, including the date of the Breach and the date of discovery; 2. a description of the types of Unsecured PHI involved (such as name, date of birth, diagnosis, treatment notes, or financial information); 3. the identification of each Individual whose Unsecured PHI was or is reasonably believed to have been accessed, acquired, used, or disclosed; 4. any steps Individuals should take to protect themselves from potential harm; 5. a brief description of what Business Associate is doing to investigate, mitigate harm, and protect against further Breaches; and 6. contact procedures for Covered Entity and Individuals to ask questions or learn additional information.

(d) Security Incidents. Business Associate shall report to Covered Entity any Security Incident of which it becomes aware, in accordance with the timeframes above. The Parties acknowledge and agree that this Section constitutes notice of, and Business Associate need not provide separate individual notice of, unsuccessful Security Incidents that do not result in unauthorized access to, or Use or Disclosure of, PHI, including without limitation pings and other broadcast attacks on a firewall, port scans, unsuccessful log-on attempts, denial of service attacks, and malware that is blocked or quarantined without effect. Business Associate shall make a log of such unsuccessful Security Incidents available to Covered Entity upon reasonable written request.

(e) Cooperation. Business Associate shall reasonably cooperate with Covered Entity in Covered Entity's investigation of, and response to, any Breach or Security Incident, including providing information reasonably necessary for Covered Entity to satisfy its own notification obligations under 45 CFR 164.404, 164.406, and 164.408, and under applicable state law.

2.6 Subcontractors. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate shall ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to restrictions and conditions that are at least as restrictive as those that apply to Business Associate under this Agreement, including the applicable Security Rule requirements at 45 CFR 164.314(a). Business Associate remains responsible to Covered Entity for the acts and omissions of its Subcontractors with respect to PHI to the same extent as for its own acts and omissions. Business Associate maintains a current list of Subcontractors that receive PHI in its published privacy notice. Upon written request, Business Associate shall identify its then-current Subcontractors that handle PHI and shall make available a copy of the relevant written agreement, redacted as to commercial terms, within fifteen (15) business days.

2.7 Access. Business Associate shall make available PHI in a Designated Record Set to Covered Entity, or as directed by Covered Entity to an Individual, as necessary to satisfy Covered Entity's obligations under 45 CFR 164.524. Business Associate shall do so within ten (10) business days of Covered Entity's written request, so that Covered Entity can meet the response deadline imposed on it by that section. Where PHI is maintained electronically, Business Associate shall provide it in the electronic form and format requested if readily producible in that form and format.

2.8 Amendment. Business Associate shall make available PHI for amendment, and shall incorporate any amendment to PHI in a Designated Record Set, as directed by Covered Entity, as necessary to satisfy Covered Entity's obligations under 45 CFR 164.526. Business Associate shall do so within thirty (30) calendar days of Covered Entity's written request, so that Covered Entity retains adequate time to meet the sixty (60) day response deadline imposed on it by that section.

2.9 Accounting of disclosures. Business Associate shall maintain and make available to Covered Entity the information required to provide an accounting of disclosures as necessary to satisfy Covered Entity's obligations under 45 CFR 164.528. Business Associate shall do so within thirty (30) calendar days of Covered Entity's written request, and shall retain such information for at least six (6) years from the date of the disclosure.

2.10 Covered Entity obligations performed by Business Associate. To the extent Business Associate is to carry out one or more of Covered Entity's obligations under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of those obligations.

2.11 Availability to the Secretary. Business Associate shall make its internal practices, books, and records relating to the Use and Disclosure of PHI available to the Secretary for purposes of determining Covered Entity's compliance with the HIPAA Rules. Business Associate shall notify Covered Entity of any such request as soon as practicable, unless prohibited by law from doing so.

2.12 Psychotherapy Notes. Business Associate acknowledges that the Services may store Psychotherapy Notes and that Psychotherapy Notes require an Individual's authorization for most Uses and Disclosures under 45 CFR 164.508(a)(2). Business Associate shall not Use or Disclose Psychotherapy Notes for any purpose other than storing, transmitting, and making them available to Covered Entity as part of the Services, and shall not Disclose Psychotherapy Notes to any third party absent a valid authorization or an express requirement of law. Business Associate shall preserve the functional separation between Psychotherapy Notes and the balance of the Designated Record Set so that Psychotherapy Notes are not included in a record produced in response to an Individual's request for access unless Covered Entity expressly directs otherwise.

2.13 Documentation retention. Business Associate shall maintain the policies, procedures, and documentation required by 45 CFR 164.316 for six (6) years from the date of creation or the date when last in effect, whichever is later.

2.14 State law. Where a state law applicable to Covered Entity's practice imposes requirements on the confidentiality, security, or breach notification of health information that are more stringent than the HIPAA Rules, and Covered Entity has given Business Associate written notice of that requirement, Business Associate shall comply with the more stringent requirement with respect to Covered Entity's PHI to the extent reasonably practicable within the Services as offered.

2.15 Substance use disorder records. The Services are not designed or intended for use by a "part 2 program" as defined at 42 CFR 2.11, and Business Associate makes no representation that the Services comply with 42 CFR Part 2. Covered Entity represents that it is not a part 2 program and shall not use the Services to create, receive, maintain, or transmit records subject to 42 CFR Part 2. If Covered Entity becomes a part 2 program during the term of this Agreement, it shall promptly notify Business Associate, and the Parties shall discuss in good faith whether continued use of the Services is appropriate.

2.16 Individual requests received directly. Except as otherwise provided in this Agreement, if an Individual, or an Individual's personal representative, submits a request for access to, amendment of, or an accounting of Disclosures of PHI, or a similar request, directly to Business Associate, Business Associate shall redirect the Individual to Covered Entity. Covered Entity retains sole responsibility for determining whether and how to respond to the request and for compliance with 45 CFR 164.524, 164.526, and 164.528.

3. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE

3.1 Performance of the Services. Business Associate may Use and Disclose PHI as necessary to perform the Services, provided that such Use or Disclosure would not violate the HIPAA Rules if done by Covered Entity, except as permitted by Sections 3.3 and 3.4.

3.2 Required by law. Business Associate may Use or Disclose PHI as Required By Law.

3.3 Management and administration. Business Associate may Use PHI for the proper management and administration of Business Associate and to carry out its legal responsibilities. Business Associate may Disclose PHI for those purposes only if:

(a) the Disclosure is Required By Law; or

(b) Business Associate obtains reasonable assurances in writing from the person to whom the PHI is disclosed that the PHI will be held confidentially and Used or further Disclosed only as Required By Law or for the purpose for which it was disclosed, and that the person will notify Business Associate of any instance of which it is aware in which the confidentiality of the PHI has been breached.

3.4 Data Aggregation. Business Associate may Use PHI to provide Data Aggregation services relating to the Health Care Operations of Covered Entity, as permitted by 45 CFR 164.504(e)(2)(i)(B). Business Associate shall not Disclose PHI of Covered Entity to another covered entity in the course of providing Data Aggregation services.

3.5 De-identification.

(a) Business Associate may De-Identify PHI in accordance with 45 CFR 164.514(b), using either the expert determination method at 164.514(b)(1) or the safe harbor method at 164.514(b)(2). Business Associate shall document the method used and shall make that documentation available to Covered Entity upon written request.

(b) De-Identified Data is not PHI and is not subject to the restrictions of this Agreement. Business Associate may Use De-Identified Data for improving, developing, supporting, and securing the Services, for internal research and analytics, and for producing aggregate benchmarks and statistics. Business Associate may publish, license, or sell aggregate statistics and benchmarks derived from De-Identified Data, provided that any such statistic is derived from De-Identified Data across multiple covered entities and does not identify Covered Entity, any Individual, or Covered Entity's practice.

(c) Business Associate shall not attempt to re-identify De-Identified Data, shall not disclose De-Identified Data to any third party under terms that permit re-identification, and shall require any recipient of De-Identified Data to agree in writing not to attempt re-identification.

(d) For the avoidance of doubt, Business Associate does not sell PHI, does not sell De-Identified Data that identifies or could reasonably be used to identify Covered Entity or any Individual, and does not disclose PHI to data brokers, advertisers, insurers, or employers.

3.6 No training on PHI. Business Associate shall not Use or Disclose PHI to train, fine-tune, or otherwise develop or improve any Machine Learning Model, including any model derived from De-Identified Data that could reasonably be used to identify an Individual.

3.7 Sale of PHI and marketing. Business Associate shall not sell PHI or receive remuneration in exchange for PHI, and shall not Use or Disclose PHI for marketing or fundraising purposes, except as expressly permitted by the HIPAA Rules and authorized in writing by Covered Entity.

3.8 No other use. Business Associate has no rights in PHI other than those expressly granted in this Agreement. As between the Parties, PHI is and remains the property of Covered Entity or the Individual, as applicable.

3.9 Reports to authorities. Business Associate may Use or Disclose PHI to report conduct it believes in good faith to be unlawful to an appropriate federal, state, or local health oversight agency, public health authority, or law enforcement official, and to make the Disclosures permitted by 45 CFR 164.502(j), notwithstanding any other provision of this Agreement.

4. OBLIGATIONS OF COVERED ENTITY

4.1 Notice of Privacy Practices. Covered Entity shall notify Business Associate in writing of any limitation in its Notice of Privacy Practices, to the extent that such limitation may affect Business Associate's Use or Disclosure of PHI.

4.2 Changes in permission. Covered Entity shall notify Business Associate in writing of any changes in, or revocation of, an Individual's permission to Use or Disclose PHI, to the extent that such change may affect Business Associate's Use or Disclosure of PHI.

4.3 Restrictions. Covered Entity shall notify Business Associate in writing of any restriction on the Use or Disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associate's Use or Disclosure of PHI. Covered Entity acknowledges that Business Associate can honor only those restrictions that the Services are technically capable of implementing, and shall not agree to a restriction that the Services cannot support without first confirming with Business Associate.

4.4 Permissible requests. Covered Entity shall not request that Business Associate Use or Disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity, except as permitted by Sections 3.3 and 3.4.

4.5 Authorizations and consents. Covered Entity is solely responsible for obtaining any consent, authorization, or acknowledgment required by law before PHI is provided to Business Associate or entered into the Services, and for the accuracy and lawfulness of the PHI it submits.

4.6 Account security. Covered Entity is responsible for maintaining the confidentiality of its account credentials, for configuring the Services appropriately for its practice, for the acts and omissions of any workforce member it authorizes to access the Services, and for promptly disabling access when a workforce member departs. Covered Entity shall use the multi-factor or passkey authentication offered by the Services.

4.7 Covered Entity's own vendors. Where Covered Entity connects an account it holds with a third-party provider to the Services, including without limitation video conferencing or calendar accounts, that provider acts as a business associate of Covered Entity rather than as a Subcontractor of Business Associate. Covered Entity is solely responsible for executing any business associate agreement required with that provider and for the configuration of that account.

4.8 Payment processing. Client payments are processed on a connected account held in Covered Entity's name with Business Associate's payment processor, provisioned through Business Associate's platform. Covered Entity is the merchant of record for its own clinical services, and the processor, not Business Associate, holds and disburses those funds. As described in Appendix A, Section A.6, the processor receives a pseudonymous client nickname, an opaque reference, and an amount, and receives no PHI. The processor is accordingly neither a Subcontractor of Business Associate for purposes of Section 2.6 nor a business associate of Covered Entity. Covered Entity is responsible for completing the processor's identity verification and for the accuracy of the payout details it provides.

4.9 Professional judgment. Business Associate does not provide clinical, legal, or compliance advice. Covered Entity retains sole responsibility for its own HIPAA compliance program, including its risk analysis, policies, workforce training, and its own notifications to Individuals following a Breach.

5. TERM AND TERMINATION

5.1 Term. This Agreement takes effect on the Effective Date and continues until all PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is returned or destroyed in accordance with Section 5.4, or until terminated as provided below.

5.2 Relationship to the Underlying Agreement. This Agreement survives the expiration or termination of the Underlying Agreement for so long as Business Associate retains PHI. Termination of the Underlying Agreement does not by itself terminate this Agreement.

5.3 Termination for cause. Covered Entity may terminate this Agreement and the Underlying Agreement if Covered Entity determines that Business Associate has materially breached this Agreement and Business Associate has failed to cure the breach within thirty (30) days of written notice, or if cure is not possible, immediately upon written notice. Business Associate has the reciprocal right with respect to a material breach by Covered Entity. Either Party may report the violation to the Secretary if termination is not feasible.

5.4 Effect of termination.

(a) Export period. For thirty (30) days following termination, Business Associate shall maintain Covered Entity's PHI and shall provide Covered Entity with continued access sufficient to export its records in a usable electronic format, at no additional charge. Covered Entity may request one extension of up to an additional thirty (30) days.

(b) Deletion from production systems. Following the export period, Business Associate shall delete Covered Entity's PHI from its production systems.

(c) Backups. PHI may persist in encrypted backup media for up to ninety (90) days after deletion from production systems, after which it is deleted in the ordinary course of Business Associate's backup rotation. Business Associate shall extend all protections of this Agreement to PHI held in backup media and shall make no Use or Disclosure of it other than for disaster recovery.

(d) Audit logs. Business Associate maintains immutable, append-only audit logs recording access to PHI. Those logs cannot be altered or deleted, including by Business Associate, and are retained as required by 45 CFR 164.316(b)(2)(i) and Section 2.9 of this Agreement. Retention of audit log records is an express exception to subsections (b) and (c), and all protections of this Agreement continue to apply to them.

(e) Where return or destruction is otherwise infeasible. If Business Associate determines that returning or destroying PHI is infeasible for reasons other than those described above, Business Associate shall notify Covered Entity in writing of the conditions that make it infeasible, shall extend the protections of this Agreement to that PHI, and shall limit further Uses and Disclosures to those purposes that make the return or destruction infeasible, for so long as it retains the PHI. Business Associate shall destroy such PHI when the condition no longer applies.

(f) Certification. Business Associate shall provide written certification of deletion upon request.

(g) Subcontractors. Business Associate shall direct any Subcontractor holding PHI to comply with this Section.

5.5 Cessation of operations. If Business Associate ceases to provide the Services or to operate, it shall give Covered Entity written notice as far in advance as reasonably practicable, and in no event fewer than thirty (30) days, and shall provide Covered Entity with a complete, machine-readable export of its records before any deletion. Where the Underlying Agreement provides for a longer notice period, that longer period applies.

5.6 Survival. Sections 2.11, 2.13, 3.5(c), 3.6, 3.8, 5.4, 5.6, and 6 survive termination.

6. GENERAL PROVISIONS

6.1 Regulatory references. A reference in this Agreement to a section of the HIPAA Rules means the section as in effect or as amended.

6.2 Amendment and waiver. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for the Parties to comply with the requirements of the HIPAA Rules. Business Associate may propose an amendment by written notice to Covered Entity; if Covered Entity does not object in writing within fourteen (14) days, and the amendment does no more than conform this Agreement to a change in the HIPAA Rules, the amendment takes effect. Any other amendment requires the written agreement of both Parties. No waiver of any provision of this Agreement is effective unless in writing and signed by the waiving Party. The failure of either Party at any time to insist upon strict performance of any provision is not a waiver of that provision and does not bar the exercise of any right or remedy as to a subsequent event. The failure of either Party at any time to insist upon strict performance of any provision is not a waiver of that provision and does not bar the exercise of any right or remedy as to a subsequent event.

6.3 Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits the Parties to comply with the HIPAA Rules. In the event of a conflict between this Agreement and the Underlying Agreement with respect to PHI, this Agreement controls.

6.4 No third-party beneficiaries. Nothing in this Agreement confers any rights, remedies, obligations, or liabilities on any person other than the Parties and their respective successors and permitted assigns.

6.5 Independent contractors. Nothing in this Agreement creates a partnership, joint venture, employment, or agency relationship between the Parties.

6.6 Governing law and dispute resolution. This Agreement is governed by the laws of the State of Arizona, without regard to its conflict of laws principles, except to the extent preempted by federal law. The dispute resolution provisions of the Underlying Agreement, including any agreement to arbitrate and any waiver of class proceedings, apply to disputes arising under or relating to this Agreement.

6.7 Notices. Notices under this Agreement shall be in writing and addressed to the addresses in the signature block. A notice is effective on delivery when sent by email with confirmation of receipt, and three (3) business days after deposit in the United States mail when sent certified or registered, return receipt requested, postage prepaid. Notices to Business Associate shall be sent to [email protected] and to 4539 N 22nd St #7488, Phoenix, Arizona 85016. Business Associate's mailing address does not accept hand delivery, packages, or courier deliveries requiring a signature. Either Party may change its notice address by written notice to the other.

6.8 Assignment. Neither Party may assign this Agreement without the other Party's written consent, except that Business Associate may assign it to a successor in connection with a merger, acquisition, or sale of substantially all assets, provided the successor assumes all obligations under this Agreement in writing and Business Associate gives Covered Entity written notice within thirty (30) days.

6.9 Severability. If any provision of this Agreement is held invalid or unenforceable, the remainder continues in full force, and the invalid provision shall be reformed to the minimum extent necessary to make it enforceable while preserving its intent.

6.10 Counterparts and electronic signature. This Agreement may be executed in counterparts, including by electronic signature, each of which is an original and all of which together constitute one instrument.

6.11 Entire agreement. This Agreement, together with Appendix A, constitutes the entire agreement between the Parties with respect to the Use and Disclosure of PHI and supersedes any prior understanding on that subject.

IN WITNESS WHEREOF, the Parties have executed this Agreement as of the dates written below.

COVERED ENTITY

| | | |---|---| | Name of individual or practice | `___________` | | Signatory name | `___________` | | Title or credential | `___________` | | License number and state | `___________` | | NPI | `___________` | | Practice address | `___________` | | Email for notices | `___________` | | Signature | `___________` | | Date | `___________` |

BUSINESS ASSOCIATE

| | | |---|---| | Entity | TrustedPsych, LLC | | Signatory name | Sterling Baker | | Title | Co-Founder | | Address | 4539 N 22nd St #7488, Phoenix, Arizona 85016 | | Email for notices | [email protected] | | Signature | `___________` | | Date | `___________` |

APPENDIX A: SECURITY MEASURES

Business Associate implements and maintains at least the following safeguards with respect to ePHI. Business Associate may substitute a measure of equal or greater protective effect.

A.1 Encryption. PHI is encrypted at rest using AES-256-GCM before it is written to the database. All data in transit is encrypted using TLS 1.3 or higher. Decryption occurs server-side only.

A.2 Access control. Access to PHI is restricted by row-level security so that each Covered Entity's records are logically isolated and accessible only to that Covered Entity and its authorized workforce. Business Associate personnel access to production PHI is limited to those with a documented operational need, is individually authenticated, and is logged.

A.3 Authentication. The Services support passkey authentication (WebAuthn, including Face ID, Touch ID, and device PIN). Sessions automatically terminate after thirty (30) minutes of inactivity.

A.4 Audit logging. Business Associate maintains immutable, append-only audit logs recording access to PHI, including the identity of the accessing account, the record accessed, and the time of access. Logs cannot be altered or deleted and are retained for no less than six (6) years.

A.5 Data minimization in logs and URLs. PHI is not included in application logs, error reports, or URL paths or query strings.

A.6 Third-party data minimization. Where the Services integrate with third-party providers for calendar, payments, or messaging, client identity is transmitted using a pseudonymous nickname rather than the client's real name, and no clinical content is transmitted. Specifically: the calendar integration receives a nickname and a meeting link only, with no client listed as a guest; and the payments integration identifies customers by nickname only and receives no clinical information. A current list of Subcontractors that receive PHI is maintained in Business Associate's published privacy notice and is available under Section 2.6.

A.7 Audio. The Services do not record, listen to, or transcribe clinical sessions. Audio processing is limited to dictation recorded by Covered Entity after a session for the purpose of creating documentation, and is transcribed by a model operating entirely within Business Associate's own infrastructure. Neither audio nor transcripts are transmitted to any third-party service.

A.8 Backups. Business Associate maintains encrypted backups of PHI.

A.9 Workforce. Business Associate provides HIPAA and security training to workforce members with access to PHI upon hire and at least annually, and requires written confidentiality obligations.

A.10 Risk analysis. Business Associate conducts a security risk analysis consistent with 45 CFR 164.308(a)(1)(ii)(A) at least annually and following any material change to its systems.