Business Associate Agreement

1. Definitions

Capitalized terms not defined here have the meanings given in the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 C.F.R. Parts 160 and 164, as amended, including by the HITECH Act ("HIPAA"). "PHI" means Protected Health Information that Business Associate handles for Customer. "Services" means the Dispense Flow platform described in the Terms of Service.

2. Permitted uses and disclosures

Business Associate may use and disclose PHI only:

• to provide the Services to Customer, including hosting storefronts, processing intake, routing orders to providers and pharmacies Customer has selected, processing payments and subscriptions, and providing support;
• as required by law;
• for Business Associate's proper management and administration, provided any disclosure is required by law or the recipient gives reasonable written assurances of confidentiality and agrees to report breaches;
• to provide Data Aggregation services relating to Customer's health care operations, if requested;
• to de-identify PHI in accordance with 45 C.F.R. § 164.514(b), after which the data is no longer PHI.

Business Associate will not use or disclose PHI in a way that would violate Subpart E of 45 C.F.R. Part 164 if done by Customer, will not sell PHI, and will not use PHI for marketing without the authorizations HIPAA requires. Business Associate will request, use and disclose only the minimum necessary PHI.

3. Obligations of Business Associate

• Safeguards. Implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of electronic PHI, in compliance with Subpart C of 45 C.F.R. Part 164, including encryption of PHI in transit and at rest, role-based access controls and audit logging.
• Reporting. Report to Customer any use or disclosure of PHI not permitted by this BAA, any Security Incident, and any Breach of Unsecured PHI, without unreasonable delay and in no case later than ten (10) business days after discovery, with the information Customer needs to meet its notification obligations under 45 C.F.R. § 164.410. Unsuccessful Security Incidents such as pings, port scans and blocked login attempts that do not result in unauthorized access are reported by this sentence and not individually.
• Subcontractors. Ensure that any subcontractor that creates, receives, maintains or transmits PHI on Business Associate's behalf agrees in writing to the same restrictions and conditions that apply to Business Associate, per 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2). Current subcontractors are listed in Exhibit A; Business Associate will update the list and give Customer notice of additions.
• Individual rights. Within ten (10) business days of Customer's request, make PHI in a Designated Record Set available so Customer can meet access requests under § 164.524, make amendments under § 164.526, and provide information needed for an accounting of disclosures under § 164.528. Individual requests received directly by Business Associate will be forwarded to Customer within five (5) business days.
• Customer obligations under Subpart E. To the extent Business Associate carries out any of Customer's obligations under Subpart E, comply with the requirements that apply to Customer in performing them.
• HHS access. Make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services for determining compliance with HIPAA.
• Mitigation. Mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure in violation of this BAA.

4. Obligations of Customer

• Provide only the PHI that is minimally necessary for Business Associate to perform the Services, and configure the platform (including storefront settings, questionnaires and integrations) in a way that complies with HIPAA.
• Notify Business Associate of any limitation in Customer's notice of privacy practices, any change in or revocation of an individual's authorization, and any restriction on use or disclosure Customer has agreed to, to the extent it affects Business Associate.
• Not request Business Associate to use or disclose PHI in a way that would not be permitted under HIPAA if done by Customer.
• Obtain any consents and authorizations required to allow the providers, pharmacies and third-party integrations Customer selects to receive PHI.
• Maintain its own notice of privacy practices, patient consents and HIPAA compliance program. Business Associate is not responsible for Customer's status as a covered entity or business associate.

5. Term and termination

This BAA takes effect when Customer accepts the Terms of Service and continues until all PHI is returned or destroyed under Section 6.

Either party may terminate this BAA and the Services if the other party materially breaches this BAA and does not cure the breach within thirty (30) days of written notice, or immediately if cure is not possible. Termination of the Terms of Service terminates this BAA, subject to Section 6.

6. Return or destruction of PHI

On termination, Business Associate will make PHI available to Customer for export for thirty (30) days, then return or destroy all PHI it holds, including copies held by subcontractors, and retain none, except where return or destruction is infeasible, in which case Business Associate will extend the protections of this BAA to that PHI, limit further uses and disclosures to the purposes that make return or destruction infeasible, and destroy it when those purposes end. Backup copies will be destroyed in the ordinary rotation of backups, not to exceed ninety (90) days.

7. Miscellaneous

• This BAA is interpreted to permit compliance with HIPAA. Any ambiguity is resolved in favor of a meaning that complies with HIPAA. If HIPAA is amended, the parties will amend this BAA as needed to comply.
• If this BAA conflicts with the Terms of Service regarding PHI, this BAA controls.
• Nothing in this BAA creates rights in any third party, including patients.
• The parties may sign a separate, negotiated BAA for Enterprise customers; a signed BAA replaces this one for that customer.
• Notices to Business Associate go to Dispense Flow, 9461 Charleville Blvd #1235, Beverly Hills, CA 90212, United States, with a copy by email to l@dispenseflow.com. Either party may update its notice address by written notice. Notices to Covered Entity go to the email on the Customer account.

8. Assignment and Successors

Business Associate may assign this BAA, without Covered Entity's consent, to an affiliate or to a successor that acquires all or substantially all of the business or assets to which this BAA relates, provided that the assignee agrees in writing to be bound by this BAA and to comply with the obligations of a business associate under HIPAA with respect to all Protected Health Information received, created, or maintained under it. Business Associate will provide Covered Entity written notice of any such assignment within thirty (30) days. Covered Entity may not assign this BAA without Business Associate's prior written consent, not to be unreasonably withheld. This BAA binds and benefits the parties and their permitted successors and assigns.

Exhibit A: Subcontractors

Subcontractors that may process PHI in providing the Services:

• Amazon Web Services, Inc. (cloud hosting, storage, backups and email delivery), United States
• Payment processor selected by Customer (payment data only), United States
• Independent providers and pharmacies selected by Customer receive PHI as Customer's own recipients, not as Business Associate's subcontractors.

Questions about this BAA: legal@dispenseflow.com, Dispense Flow, 9461 Charleville Blvd #1235, Beverly Hills, CA 90212.