HIPAA Business Associate Agreement

1. Permitted Uses and Disclosures

Business Associate may use and disclose PHI only as necessary to perform the services described in the Terms of Service — call routing and delivery, voicemail, call recording where enabled by Covered Entity, AI transcription and summarization where enabled by Covered Entity, messaging, contact records, billing, and support — or as Required By Law.

Business Associate may use PHI for its own proper management and administration and to carry out its legal responsibilities. Business Associate may disclose PHI for those purposes only where the disclosure is Required By Law, or where Business Associate obtains reasonable assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required By Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any breach of confidentiality.

Business Associate will not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity. Business Associate will not sell PHI and will not use or disclose PHI for marketing, fundraising, or the creation of de-identified data sets for its own commercial purposes.

Business Associate will make reasonable efforts to use, disclose, and request only the minimum necessary PHI to accomplish the intended purpose.

2. Safeguards

Business Associate will implement and maintain administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI, and will comply with Subpart C of 45 C.F.R. Part 164 (the Security Rule) with respect to electronic PHI.

• Encryption of PHI in transit over public networks and encryption of stored recordings, voicemail, and transcripts at rest.
• Role-based access control, so PHI is reachable only by accounts and personnel with a need to access it.
• Access and administrative activity logging sufficient to reconstruct who accessed PHI and when.
• Workforce training, confidentiality obligations, and prompt revocation of access on role change or departure.
• Documented retention and disposal of recordings, voicemail, and transcripts in accordance with Covered Entity’s configured retention settings.

3. Subcontractors

Business Associate will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on Business Associate’s behalf agrees in writing to restrictions and conditions at least as protective as those that apply to Business Associate under this Agreement, in accordance with 45 C.F.R. § 164.502(e)(1)(ii) and § 164.308(b)(2).

Business Associate remains responsible for the acts and omissions of its subcontractors with respect to PHI. A current list of categories of subcontractors used to deliver the service is maintained on the Centelos Sub-processors page.

4. Reporting of Breaches and Security Incidents

Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this Agreement of which it becomes aware, including any Breach of Unsecured PHI as required by 45 C.F.R. § 164.410, and any Security Incident of which it becomes aware.

Notification of a Breach of Unsecured PHI will be made without unreasonable delay and in no case later than thirty (30) calendar days after discovery, and will include, to the extent known: the individuals affected, the nature of the PHI involved, the date of the incident and of discovery, the circumstances, and the mitigation and remediation steps taken.

Unsuccessful Security Incidents that do not result in unauthorized access to, or use, disclosure, modification, or destruction of PHI — such as routine port scans, blocked authentication attempts, or denied network traffic — are reported on request rather than individually.

5. Individual Rights

Business Associate will, within fifteen (15) business days of a written request from Covered Entity, make available PHI in a Designated Record Set in its possession as necessary for Covered Entity to satisfy its obligations under 45 C.F.R. § 164.524 (access), § 164.526 (amendment), and § 164.528 (accounting of disclosures).

Where Covered Entity can retrieve the PHI directly through the platform’s own features, Business Associate may satisfy a request by identifying the feature that produces it.

Business Associate will comply with any restriction on the use or disclosure of PHI that Covered Entity has agreed to under 45 C.F.R. § 164.522 and that Covered Entity communicates to Business Associate in writing, to the extent the restriction affects Business Associate’s permitted uses and disclosures.

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity’s compliance with the HIPAA Rules.

6. Covered Entity Obligations

Covered Entity will notify Business Associate of any limitation in its Notice of Privacy Practices, any change in or revocation of an individual’s authorization, and any restriction on use or disclosure of PHI to which it has agreed, in each case to the extent it affects Business Associate’s use or disclosure of PHI.

Covered Entity will not request that Business Associate use or disclose PHI in a manner that would not be permitted under Subpart E of 45 C.F.R. Part 164 if done by Covered Entity.

Covered Entity is responsible for its own configuration of the platform, including whether call recording, voicemail transcription, AI transcription and summarization, messaging, and email delivery of voicemail are enabled, for the retention periods it selects, and for which of its personnel are granted access to PHI within its account.

7. Term and Termination

This Agreement takes effect on the date of signature below and continues until all PHI received from, or created or received on behalf of, Covered Entity is returned or destroyed, or until terminated in accordance with this section.

Covered Entity may terminate this Agreement and the underlying services if Business Associate materially breaches this Agreement and fails to cure the breach within thirty (30) days of written notice, or immediately if cure is not possible.

On termination, Business Associate will return or destroy all PHI it maintains in any form and retain no copies, except where return or destruction is infeasible. Where infeasible, Business Associate will extend the protections of this Agreement to the retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as the PHI is retained.

8. Miscellaneous

This Agreement is governed by the laws of the State of Arizona, excluding its conflict-of-laws rules, except where HIPAA or other federal law controls.

A reference to a section of the HIPAA Rules means that section as in effect or as amended. The parties will amend this Agreement as necessary to comply with changes to the HIPAA Rules.

Any ambiguity in this Agreement will be resolved in favor of a meaning that permits compliance with the HIPAA Rules. In the event of a conflict between this Agreement and the Terms of Service with respect to PHI, this Agreement controls.

There are no third-party beneficiaries to this Agreement. This Agreement may be executed electronically; a typed signature together with the recorded timestamp and network address constitutes a valid signature.