1. Definitions

Capitalized terms not otherwise defined have the meanings assigned under the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and their implementing regulations, including 45 C.F.R. Parts 160 and 164 (collectively, "HIPAA"). "PHI" includes electronic PHI ("ePHI") where applicable. "Breach," "Security Incident," "Unsecured PHI," "Use," "Disclosure," and "Subcontractor" have the meanings provided by HIPAA.

2. Relationship and Purpose

Client may disclose PHI to Zeumatic, and Zeumatic may create, receive, maintain, or transmit PHI on Client's behalf, in connection with ZEUMATIC CRM, billing, claims, eligibility, remittance, workflow, support, hosting, analytics, routing, document-management, AI-assisted, and related services. Zeumatic is a Business Associate to the extent required by HIPAA.

3. Permitted Uses and Disclosures by Zeumatic

Zeumatic may Use or Disclose PHI only as permitted by this BAA, the Services Agreement, Client's documented instructions, or as Required by Law. Subject to HIPAA, Zeumatic may Use or Disclose PHI as necessary to perform the services for Client, including hosting, processing, transmitting, claims submission, EDI, support, maintenance, troubleshooting, security, implementation, backup, restoration, and system administration.

Zeumatic may Use PHI for its proper management and administration or to carry out its legal responsibilities where permitted by HIPAA. Zeumatic may Disclose PHI for those purposes only if the Disclosure is Required by Law or Zeumatic obtains reasonable assurances from the recipient that the PHI will remain confidential and be Used or further Disclosed only as Required by Law or for the purpose for which it was disclosed, and the recipient agrees to notify Zeumatic of any known breach of confidentiality.

Zeumatic may provide Data Aggregation services relating to Client's healthcare operations if permitted by HIPAA. Zeumatic may create de-identified information in accordance with HIPAA and may use or disclose such properly de-identified information as permitted by law and the Services Agreement.

4. Prohibited Uses and Disclosures

Zeumatic will not Use or Disclose PHI in a manner that would violate the HIPAA Privacy Rule if done by Client, except for uses and disclosures expressly permitted to a business associate by HIPAA and this BAA. Zeumatic will not sell PHI except as expressly permitted by HIPAA and authorized in writing where required.

5. Minimum Necessary

To the extent applicable, Zeumatic will make reasonable efforts to limit Uses, Disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose, consistent with HIPAA and Client's configuration or instructions.

6. Safeguards and Security Rule Compliance

Zeumatic will implement appropriate administrative, physical, and technical safeguards to prevent Use or Disclosure of PHI other than as provided by this BAA and will comply with the applicable requirements of the HIPAA Security Rule with respect to ePHI. Zeumatic will maintain reasonable measures designed to preserve the confidentiality, integrity, and availability of ePHI that it creates, receives, maintains, or transmits on Client's behalf.

7. Support, Maintenance and Authorized Access to PHI

Client authorizes Zeumatic's authorized workforce members and approved service providers to access PHI when reasonably necessary to provide support, implementation, maintenance, troubleshooting, security, incident response, software updates, upgrades, configuration, migration, restoration, backup, hosting, interoperability, and other services under the Services Agreement. Zeumatic will limit such access to persons with a legitimate need for access and will apply appropriate safeguards. Support and administrative access may be logged and audited.

8. Reporting of Impermissible Uses/Disclosures, Breaches and Security Incidents

Zeumatic will report to Client any Use or Disclosure of PHI not provided for by this BAA of which Zeumatic becomes aware, including Breaches of Unsecured PHI as required by HIPAA, and will report Security Incidents as required by HIPAA. Notices to Zeumatic regarding suspected incidents should be sent to security@zeumatic.com.

For a Breach of Unsecured PHI for which Zeumatic has reporting obligations, Zeumatic will provide Client the information reasonably available to Zeumatic that Client needs to meet applicable breach-notification obligations, including identification of affected individuals where known and other information required by applicable law. The timing of notice will comply with HIPAA and any stricter timing expressly agreed in a signed Services Agreement.

9. Subcontractors

Zeumatic will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on Zeumatic's behalf agrees in writing to restrictions, conditions, safeguards, and Security Rule obligations that are at least as protective as those applicable to Zeumatic under this BAA, as required by HIPAA.

10. Access to PHI

To the extent Zeumatic maintains PHI in a Designated Record Set on Client's behalf and such PHI is accessible to Zeumatic, Zeumatic will make PHI available to Client as reasonably necessary for Client to satisfy its obligations under 45 C.F.R. § 164.524. Zeumatic may require Client to submit requests through designated secure procedures.

11. Amendment of PHI

To the extent required by HIPAA and applicable to PHI maintained by Zeumatic in a Designated Record Set, Zeumatic will make PHI available to Client for amendment and will incorporate amendments as directed by Client in accordance with 45 C.F.R. § 164.526.

12. Accounting of Disclosures

Zeumatic will document Disclosures of PHI and information relating to such Disclosures as required for Client to respond to a request for an accounting under 45 C.F.R. § 164.528, and will provide such information to Client upon reasonable request.

13. Delegated Privacy Rule Obligations

To the extent Zeumatic is expressly delegated a Client obligation under the HIPAA Privacy Rule, Zeumatic will comply with the requirements of the Privacy Rule that apply to Client in the performance of that delegated obligation.

14. Availability of Books and Records to HHS

Zeumatic will make its internal practices, books, and records relating to the Use and Disclosure of PHI received from, created, or received on behalf of Client available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with HIPAA, as required by law.

15. Client Obligations

16. Term and Termination

This BAA becomes effective on the effective date shown above or, if later, when Client first discloses PHI to Zeumatic, and remains in effect while Zeumatic creates, receives, maintains, or transmits PHI on Client's behalf. Client may terminate the Services Agreement if Zeumatic materially breaches this BAA and fails to cure the breach within a reasonable cure period where cure is possible. Zeumatic may terminate the Services Agreement if Client materially breaches obligations relating to PHI or HIPAA and fails to cure within a reasonable period where cure is possible.

17. Return or Destruction of PHI

Upon termination of the Services Agreement, Zeumatic will, if feasible, return or destroy PHI received from Client or created, maintained, or received on Client's behalf that Zeumatic still maintains in any form and will retain no copies, except where return or destruction is infeasible or retention is required by law. If retention is necessary or infeasible to eliminate, Zeumatic will extend the protections of this BAA to the retained PHI and limit further Uses and Disclosures to the purposes that make return or destruction infeasible. Secure backup copies may remain until overwritten or deleted through ordinary backup-retention cycles, subject to continuing safeguards.

18. Data Ownership and No License to PHI

As between Client and Zeumatic, Client retains its rights in Client PHI. Except for the limited rights necessary to perform services and comply with law, this BAA grants Zeumatic no independent ownership right in PHI.

19. Regulatory Changes

The parties will interpret this BAA to permit compliance with HIPAA as amended from time to time. If a change in law materially affects this BAA, the parties will cooperate in good faith to amend the BAA as reasonably necessary.

20. Survival

Zeumatic's obligations relating to PHI that remains in its possession after termination survive termination of this BAA for so long as Zeumatic retains such PHI.

21. No Third-Party Beneficiaries; Governing Terms

This BAA is for the benefit of the parties and is not intended to create third-party beneficiary rights except as required by law. Florida law governs contractual matters not preempted or controlled by federal law. The BAA may be executed electronically and in counterparts.

22. Contact Information