1. Permitted Uses and Disclosures

The Business Associate may use and disclose PHI necessary to perform its obligations to the Covered Entity as set out in the Agreement or as otherwise permitted or required by Law under HIPAA, provided that the Business Associate shall not use or disclose PHI in a manner that would not be permitted if done by the Covered Entity. The Business Associate may also:

(a) use PHI (i) as necessary for its proper management and administration, or (ii) to carry out its legal responsibilities; and

(b) disclose PHI to third parties for the same purposes so long as (i) the disclosure is Required by Law or (ii) the Business Associate obtains satisfactory assurances from said third party that the PHI will be held confidentially and used or further disclosed only as Required by Law or for the purpose for which it was disclosed and that the third party will notify the Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached.

Business Associate shall only use, disclose, and request the Minimum Necessary PHI to accomplish the purpose of the use, disclosure, or request.

2. Obligations of the Business Associate

(a) Limitation on Disclosure. The Business Associate agrees not to use or further disclose PHI other than as permitted under the Agreement or BAA, or as required by Law.

(b) Safeguards. The Business Associate agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the PHI that it creates, receives, stores, maintains, or transmits on behalf of the Covered Entity according to this BAA and the Agreement, and shall prevent the use or disclosure of Covered Entity's PHI other than as provided for in this BAA, Agreement or as Required by Law.

(c) Mitigation. The Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to the Business Associate of a use or disclosure of PHI by the Business Associate in violation of the requirements of the BAA.

(d) Use of Agents/Subcontractors. The Business Associate agrees to ensure that any agents, including a subcontractor, to whom the Business Associate provides PHI received from, or created or received by, the Business Associate on behalf of the Covered Entity, agree to restrictions and conditions for the use and disclosure of PHI that are no less restrictive than those that apply to the Business Associate under this BAA.

(e) Access to PHI. Within fifteen (15) days of receiving a written request from the Covered Entity or an Individual for a copy of PHI within a Designated Record Set, the Business Associate agrees to make the requested PHI available to the Covered Entity to enable the Covered Entity to respond to an Individual who seeks to inspect or copy his/her PHI. The Business Associate is required to comply with the Security Rule with respect to electronic PHI, including but not limited to making available upon written request copies of PHI in electronic format when PHI is stored electronically. Any disclosure of, or decision not to disclose, the PHI requested by an Individual, and compliance with the requirements applicable to an Individual's right to access PHI shall be the sole responsibility of the Covered Entity.

(f) Amendment of PHI. Within fifteen (15) days of receiving a written request from the Covered Entity to make an amendment to PHI within a Designated Record Set, the Business Associate will make such amendment and will inform the Covered Entity that an amendment has been made. If the Business Associate receives an amendment request directly from an Individual, the Business Associate shall notify the Covered Entity of the request within fifteen (15) days of receiving a written request from the Individual.

(g) Accounting of Certain Disclosures. Within thirty (30) days of receiving a written request from the Covered Entity for an accounting of disclosures of PHI about an Individual, the Business Associate shall provide to the Covered Entity a listing of the persons or entities to which the Business Associate has disclosed PHI about the Individual within the prior six (6) years, along with the dates of, reasons for, and brief descriptions of the disclosures to enable the Covered Entity to respond to an Individual seeking an accounting of the disclosures of the Individual's PHI in accordance with 45 C.F.R. § 164.528.

(h) Access to Books and Records. The Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI received from, created by, or received by the Business Associate on behalf of the Covered Entity available upon request to the Secretary of the U.S. Department of Health and Human Services so that it may evaluate the Covered Entity's compliance with the Privacy Rule.

(i) Obligations of Business Associate Upon Termination. The Business Associate shall, upon termination or expiration of this BAA, if feasible, return or allow the Covered Entity to destroy all PHI received from, processed by, or received by the Business Associate on behalf of the Covered Entity, that the Business Associate still maintains in any form in connection with this BAA and the Agreement through a deletion option provided by Business Associate in the Platform and retain no copies of such PHI except as otherwise outlined in Section 5(b) of this BAA or the Agreement. If such return or destruction is not feasible as determined by the Business Associate, the Business Associate will extend the protections of this BAA to the PHI and limit further uses and disclosures to those purposes that make the return or destruction of the PHI infeasible.

(j) Reporting of Security Incident. The Business Associate shall report to the Covered Entity any Security Incident of which it becomes aware. Under 45 C.F.R. § 164.304, a Security Incident is defined as the attempted or successful unauthorized access, use, disclosure, or destruction of information or interference with system operations in an information system. Notwithstanding the foregoing, the Parties acknowledge and agree that this Section constitutes notice by the Business Associate to the Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which no additional notice to the Covered Entity is required. "Unsuccessful Security Incidents" means, without limitation, pings and other broadcast attacks on the Business Associate's firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of PHI.

3. Obligations of the Covered Entity

The Covered Entity shall:

• Notify the Business Associate of any limitation(s) in its notice of privacy practices, if such limitation(s) may affect the Business Associate's use or disclosure of PHI;
• Notify the Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose PHI, if such changes may affect the Business Associate's use or disclosure of PHI;
• Notify the Business Associate of any restriction to the use or disclosure of PHI that the Covered Entity has agreed to in accordance with HIPAA Privacy Rule, if such restriction may affect the Business Associate's use or disclosure of PHI;
• Not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule or this BAA if done by the Covered Entity.

4. Permissible Requests by Covered Entity

The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by the Covered Entity.

5. Term and Termination

(a) Term. The term of this BAA shall be effective as of the Effective Date, and shall terminate when all of the PHI provided by the Covered Entity to the Business Associate, or created or received by the Business Associate on behalf of the Covered Entity, is destroyed or returned to the Covered Entity, or, if it is infeasible to return or destroy PHI, protections are extended to such information in accordance with this BAA.

(b) Termination for Cause. Upon the Covered Entity's knowledge of a material breach by the Business Associate, the Covered Entity shall either: (i) provide an opportunity for the Business Associate to cure the breach or end the violation within the timeframe specified by the Covered Entity, and terminate this BAA and the Agreement if the Business Associate does not cure the breach or end the violation within the agreed timeframe; or (ii) immediately terminate this BAA and the Agreement if cure is not possible.

(c) Effect of Termination. Upon termination of this BAA for any reason, the Business Associate shall return or destroy all PHI received from the Covered Entity, or created or maintained by the Business Associate on behalf of the Covered Entity, and shall not retain copies of such information once the BAA is terminated.

6. Miscellaneous

(a) Amendment. The Parties agree to take such action as is necessary to amend this BAA from time to time as is necessary for the Covered Entity or the Business Associate to comply with the requirements of HIPAA, and any other applicable law.

(b) Regulatory References. A reference in this BAA to a section in HIPAA means the section as in effect or as amended.

(c) Interpretation. Any ambiguity in this BAA shall be interpreted to permit compliance with HIPAA.

(d) No Third Party Beneficiaries. Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer, upon any person other than the Parties any rights, remedies, obligations, or liabilities whatsoever.

Contact

For HIPAA-related inquiries or BAA execution:

Company: Lutin Technologies Ltd.
Email: legal@lutinx.com
Subject: "HIPAA / BAA Request"