Business Associate Agreement

The executed copy identifies the practice through its own acceptance record. This page is the standing text that record refers to.

1. Parties, scope and definitions

This Business Associate Agreement ("BAA") is between the practice named in the accepted order, the covered entity identified in the accepted service order ("Practice"), and Expy LLC ("MedTap"), acting as Practice's business associate. It takes effect on the acceptance date in the parties' agreement record and is incorporated into the MedTap Practice Service Terms.

"HIPAA Rules" means the applicable Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164, as amended. Terms including Protected Health Information ("PHI"), Electronic PHI, Breach, Unsecured PHI, Security Incident, Designated Record Set, Individual, Required By Law, Secretary, and Subcontractor have the meanings given in those rules. PHI under this BAA is information MedTap creates, receives, maintains, or transmits on Practice's behalf in performing the agreed services.

The agreed services are the electronic intake, storage, authorized access, export, and related operational support specifically enabled under Practice's order. Separate consumer services, if later offered, are not authorized by this BAA to reuse Practice's PHI.

2. Permitted uses and disclosures

MedTap may use and disclose PHI only as necessary to perform those services for Practice, as expressly permitted by this BAA, or as Required By Law. It will not use or further disclose PHI in a manner that would violate the Privacy Rule if done by Practice, except for the limited internal administration permission below as allowed by HIPAA.

MedTap may use PHI for its proper internal management and administration or to carry out its legal responsibilities only to the extent necessary. It may disclose PHI for those purposes only if Required By Law or after obtaining reasonable assurances that the recipient will keep it confidential, use or further disclose it only as Required By Law or for the disclosed purpose, and notify MedTap of a confidentiality breach of which the recipient becomes aware. These provisions do not replace subcontractor BAA requirements.

Information a patient enters into and holds in their own MedTap record, under Expy LLC's direct agreement with that patient, is not created or received by Expy LLC on Practice's behalf and is not PHI under this BAA. Information Practice submits, receives, generates or files through the service is PHI under this BAA. Expy LLC will maintain a record of which relationship each item was collected under, and will not reclassify Practice PHI as patient-held information.

MedTap will comply with applicable minimum-necessary requirements. This BAA does not authorize PHI advertising, sale, independent commercial analytics, general model training, or creation of de-identified datasets for MedTap's independent business use. Any future expansion must have a lawful basis and an appropriate expressly accepted agreement; it cannot be inferred from accepting a new product privacy notice.

3. Safeguards and incident response

MedTap will use appropriate safeguards to prevent uses and disclosures outside this BAA and will comply with the applicable requirements of the HIPAA Security Rule, 45 CFR Part 164 Subpart C, for Electronic PHI. It will maintain administrative, physical, and technical safeguards, risk analysis and risk management appropriate to its responsibilities.

MedTap will report to Practice any use or disclosure not permitted by this BAA and any Security Incident of which it becomes aware. Reports will be made without unreasonable delay and, as a commitment under this BAA, no later than five calendar days after awareness. Initial information may be incomplete; MedTap will provide material updates promptly as facts become available. Attempted incidents are not treated as automatically reported, and this reporting obligation is not waived by any general provision elsewhere.

For a Breach of Unsecured PHI, MedTap will notify Practice in accordance with 45 CFR 164.410, including its discovery standard, without unreasonable delay and no later than the five-calendar-day contractual deadline after discovery. In all cases the applicable legal deadline controls if earlier. Any legally authorized law-enforcement delay will be handled under 45 CFR 164.412. The federal outside limit of 60 days is not permission to delay a report or override the shorter contractual commitment.

To the extent known, reports will identify the affected individuals, describe what occurred and the relevant dates, the types of information involved, steps taken to contain and mitigate harm and prevent recurrence, recommended protective actions, and a contact for follow-up. MedTap will supply other available information Practice needs under 45 CFR 164.404(c), promptly supplementing the initial report.

MedTap will investigate, preserve relevant evidence, mitigate harmful effects to the extent practicable, and cooperate with Practice. Practice directs notifications to its patients, regulators, and others for its covered-entity obligations unless the parties separately agree on assistance. Neither party's own legal reporting obligations are excused or delayed by that allocation. Incident reports go to Practice's designated incident contact and MedTap's security@expymed.com, using secure methods for PHI.

4. Subcontractors

Before a subcontractor creates, receives, maintains, or transmits PHI on MedTap's behalf, MedTap will obtain a written agreement imposing the same restrictions, conditions, and requirements applicable to that PHI under this BAA, including appropriate Security Rule obligations. Encryption or lack of access to a key does not by itself remove this requirement.

MedTap will maintain a current list of PHI-processing providers and their functions at our service provider list and will provide notice before a material provider change when practicable. If MedTap becomes aware of a subcontractor's pattern of material violation, it will take reasonable steps to cure or end it and terminate the arrangement if those steps fail and termination is feasible. MedTap remains responsible for its obligations under this BAA.

5. Individual rights and Practice assistance

MedTap will make PHI in a Designated Record Set available to Practice as necessary for Practice to comply with 45 CFR 164.524, including an available electronic form and format as reasonably requested. MedTap will not decide an individual's entitlement to access on Practice's behalf unless separately delegated in writing.

MedTap will make PHI available for amendment, incorporate amendments directed or agreed to by Practice, and take other necessary measures so Practice can comply with 45 CFR 164.526. Amendments must preserve record integrity and any legally required history rather than silently overwriting an executed record.

MedTap will maintain and make available the information needed for Practice to provide an accounting of disclosures under 45 CFR 164.528. Not every technical access event is a disclosure subject to accounting; the records process must retain the information required for those disclosures that are subject to accounting.

MedTap will forward a rights request received directly from an individual to Practice promptly, ordinarily within two business days, and explain how the individual can contact Practice. Proposed service commitment: MedTap will provide requested assistance within five business days of Practice's request, or an earlier reasonably identified deadline needed for Practice to comply with law. It will promptly identify any obstacle and coordinate completion; an obstacle does not extend a statutory deadline. These internal service targets are not a statement of the statutory response periods.

To the extent MedTap carries out any of Practice's Privacy Rule obligations, it will comply with the requirements that apply to Practice in performing those obligations. The service order must identify any such delegated function.

6. Oversight and records

MedTap will make its internal practices, books, and records relating to PHI received from or created or received on behalf of Practice available to the Secretary of the US Department of Health and Human Services for determining Practice's compliance with the HIPAA Rules, as required by those rules.

MedTap will give Practice reasonable information about its performance of this BAA, subject to lawful protections for other customers, security-sensitive information, and privileged material. This contractual cooperation does not restrict the Secretary's lawful access.

7. Practice's duties

Practice will inform MedTap of limitations in its Notice of Privacy Practices, changes or revocation of individual permissions, and restrictions Practice has agreed to or must honor, to the extent they affect MedTap's use or disclosure of PHI. Practice will supply lawful instructions and current incident and privacy contacts, and promptly communicate amendments or restrictions that need to be reflected in the service.

Practice will not request a use or disclosure impermissible under the Privacy Rule, subject to the limited internal administration permission in Section 2. Practice remains responsible for its own clinical record obligations and patient notices. These duties do not reduce MedTap's independent legal obligations.

8. Term and termination

This BAA remains effective for the service relationship and for as long as MedTap or its subcontractors retain PHI covered by it. Practice may terminate this BAA and the affected services if it determines MedTap has violated a material term. Practice may allow a reasonable cure period where appropriate, but a service-terms cure period does not require Practice to continue an unsafe or unlawful arrangement.

If MedTap identifies unlawful instructions or a material Practice violation affecting PHI, it will promptly seek correction and may suspend affected processing or terminate the affected service when necessary and lawful, while supporting a safe records transition.

9. Return, destruction and survival

At termination, MedTap will, if feasible, return or destroy all PHI it maintains on Practice's behalf in any form and retain no copies. MedTap and Practice will coordinate a usable return method and confirm any agreed destruction; MedTap will require applicable subcontractors to perform corresponding return or destruction. Practice's transition instructions must be consistent with law and may not authorize indefinite unrelated reuse.

If return or destruction of particular PHI is infeasible, MedTap will notify Practice of the specific categories and reasons, extend this BAA's protections to that information, and limit further use and disclosure to the purposes that make return or destruction infeasible. It will reassess the exception and return or destroy the information when feasible. Protected backup copies follow this rule; they are not a blanket indefinite retention exception. MedTap will document completion and any remaining protected exceptions.

Return or destruction under this section applies to PHI Expy LLC maintains on Practice's behalf. It does not extend to a patient's own MedTap record, which Expy LLC holds under its separate agreement with that patient and which was not created or received on Practice's behalf. Expy LLC will identify the two categories on request and will not rely on this section to retain Practice PHI.

Safeguards, restrictions, applicable reporting, and return/destruction duties survive for as long as covered PHI is retained. Ending a paid subscription does not authorize unrestricted reuse or eliminate assistance with applicable individual rights.

10. Interpretation, amendments and execution

The BAA controls conflicting provisions in the service terms, orders, or product notices concerning PHI. The parties will amend it as necessary to comply with applicable law. Ambiguities will be interpreted to permit compliance with the HIPAA Rules. Applicable stricter legal requirements are not displaced by this BAA.

The exact accepted BAA version remains available in the agreement record. Material amendments require authorized acceptance; replacing a public webpage does not silently replace this agreement. Electronic acceptance identifies both legal parties, the authorized Practice representative, the documents accepted, and the effective date. No patient signature is required to form this agreement between the parties.

A dashed placeholder marks a detail that is not settled yet. Questions: support@expymed.com