Business Associate Agreement

1. Definitions

• PHI means Protected Health Information as defined in 45 CFR section 160.103.
• Breach, Covered Entity, Business Associate, and Security Incident have the meanings set forth in HIPAA.
• HIPAA means the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations.
• TCPA means the Telephone Consumer Protection Act, 47 U.S.C. section 227.
• Service means outbound SMS and AI-assisted phone calls to Customer's patients, performed by SAT on behalf of Customer's affiliated healthcare practitioners for healthcare operations purposes.

2. Permitted Uses and Disclosures

SAT may use and disclose PHI solely to perform the Service on Customer's behalf. SAT shall not use or disclose PHI in any manner not permitted by this BAA or HIPAA.

3. Safeguards

SAT shall implement administrative, physical, and technical safeguards reasonably designed to protect PHI. SAT shall ensure that any subcontractors with access to PHI agree to equivalent protections.

4. Breach Notification

SAT shall notify Customer without unreasonable delay, and in no event later than thirty (30) days, after discovering a Breach of unsecured PHI. Notification shall include the information required under 45 CFR section 164.410(c) to the extent known.

5. Return or Destruction of PHI

Upon termination of this BAA or the Service, SAT shall return or destroy PHI in its possession, except as required by law. Obligations under this BAA survive termination to the extent necessary to wind down PHI handling.

6. Covered Entity Obligations

Customer represents, warrants, and covenants that:

(a) Patient consent

Customer has obtained, or will obtain prior to any outbound communication, all consents and authorizations required under HIPAA and TCPA for SAT to contact Customer's patients via SMS and phone calls on Customer's behalf.

(b) Practitioner authorization

Customer has obtained, or will obtain, written authorization from each affiliated primary care physician or other healthcare practitioner whose name or identity appears in any outbound communication sent by SAT.

(c) Data accuracy

Customer is solely responsible for the accuracy and completeness of all patient data provided to SAT, including names, phone numbers, and clinical indicators.

(d) Do-not-contact list

Customer shall maintain and promptly communicate to SAT a list of patients who have opted out of outbound communications. SAT shall honor such list upon receipt.

(e) Lawful requests

Customer shall not request SAT to use or disclose PHI in any manner that would violate HIPAA or TCPA, and is solely responsible for obtaining any required patient consents or authorizations.

7. Outbound Communication Standards

All outbound communications performed under this BAA shall:

• Be drafted and delivered as communications from Customer's affiliated practitioners (for example, Dr. [Name]'s office at [Customer]), limited to healthcare operations purposes;
• Not constitute marketing or pharmaceutical promotions; any such use requires a separate HIPAA-compliant authorization;
• Include opt-out mechanisms as required by TCPA (for example, Reply STOP to unsubscribe for SMS, and a verbal opt-out option for calls);
• Comply with all applicable federal and state regulations governing automated telephone communications and text messages.

8. Limitation of Liability and Indemnification

SAT's total liability under this BAA shall not exceed the fees paid by Customer to SAT in the twelve (12) months preceding the claim. SAT shall not be liable for any indirect, incidental, or consequential damages.

Customer shall indemnify and hold SAT harmless from any claims, losses, or penalties arising from (i) Customer's violations of HIPAA or TCPA, (ii) inaccurate or incomplete patient data provided by Customer, or (iii) Customer's failure to obtain required consents or practitioner authorizations.

9. Term and Termination

This BAA is effective as of the Effective Date and continues until the Service arrangement between the parties terminates. Either party may terminate this BAA upon thirty (30) days written notice of a material breach that remains uncured.

10. General

This BAA shall be governed by the laws of the State of New York. Any ambiguity shall be resolved in favor of a meaning that permits compliance with HIPAA. This BAA constitutes the entire agreement between the parties regarding PHI and supersedes any prior agreements on this subject.