Business Associate Agreement

2.1. Permitted Uses and Disclosures:

• Business Associate shall not use or disclose PHI other than as permitted or required by this BAA, the Terms of Service, or as required by law.
• Business Associate may use or disclose PHI for the proper management and administration of its business, provided that the disclosures are required by law or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially.
• Business Associate may use PHI to provide data aggregation services relating to the health care operations of Covered Entity as permitted by 45 CFR 164.504(e)(2)(i)(B).
• Business Associate may de-identify PHI in accordance with 45 CFR 164.514(a)-(c) only to perform the Services for Covered Entity or for the other purposes permitted by this Section 2.1, and shall use and disclose the resulting de-identified information only for those same purposes.
• Business Associate shall not use PHI, or any information de-identified, anonymized, aggregated or synthesized from PHI, to train, fine-tune or otherwise improve any artificial intelligence or machine learning model, whether its own or a third party's. Each subcontractor to which Business Associate provides PHI is contractually bound not to use it to train its models. Features of the Services that adapt to Covered Entity, such as transcript correction suggestions drawn from corrections made by Covered Entity's Authorized Users, use Covered Entity's PHI only within Covered Entity's account to perform the Services, are not shared with other customers, and do not change any model.

2.2. Safeguards:

• Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI that it creates, receives, maintains, or transmits on behalf of Covered Entity.
• Business Associate shall comply with the Security Rule requirements applicable to business associates under HIPAA.
• Business Associate shall ensure that any agent, including a subcontractor, to whom it provides PHI agrees to the same restrictions and conditions that apply to Business Associate under this BAA. Business Associate shall remain liable for the acts and omissions of its subcontractors to the same extent as if Business Associate were performing the services directly.
• Business Associate shall provide at least thirty (30) days' advance notice before engaging any new subcontractor that will have access to PHI, giving Covered Entity the opportunity to object. The current subcontractor list is in the Data Processing Agreement at transcribe.health/legal/dpa.
• If Covered Entity objects in writing within thirty (30) days of Business Associate's notice, the parties shall confer in good faith for thirty (30) days to resolve the objection, which may include an alternative subcontractor or additional safeguards. If unresolved, Covered Entity's sole and exclusive remedy is to terminate this BAA and the corresponding Services, without penalty and without early-termination liability, on written notice.

2.3. Reporting:

• Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including Breaches of Unsecured PHI as required by 45 CFR 164.410.
• Business Associate shall report to Covered Entity any Successful Security Incident of which it becomes aware in accordance with the timing in this Section 2.3. The parties acknowledge that Unsuccessful Security Incidents occur frequently and carry no material risk to ePHI; this paragraph constitutes Covered Entity's notice of, and the parties' agreed reporting mechanism for, all Unsuccessful Security Incidents, which Business Associate need not report individually. On Covered Entity's reasonable written request, no more than once per calendar quarter, Business Associate shall provide an aggregate summary of the categories of Unsuccessful Security Incidents observed.
• For purposes of this BAA, "Discovery" of a Breach means the first day on which the Breach is known to Business Associate, or by exercising reasonable diligence would have been known, treating Business Associate as having knowledge if the Breach is known, or would have been known by reasonable diligence, to any workforce member or agent of Business Associate other than the person committing the Breach, consistent with 45 CFR 164.410(a)(2).
• Business Associate shall report a Breach of Unsecured PHI, and any Successful Security Incident involving Covered Entity's PHI, without unreasonable delay and in two stages: (a) a preliminary notice no later than twenty-four (24) hours after Business Associate confirms or reasonably suspects the incident (and in any case after its Discovery); and (b) a full written notice no later than seventy-two (72) hours after that same point, including, to the extent then known, the information described in 45 CFR 164.410(c). Business Associate shall then update Covered Entity as further facts become available, at regular intervals until the incident is resolved. These reporting windows are intended to allow Covered Entity to satisfy its own notification obligations, including the outer limit of without unreasonable delay and no later than sixty (60) days under 45 CFR 164.404–164.410.
• Business Associate shall cooperate with Covered Entity in the investigation of any Breach and shall preserve and make available forensic evidence and audit logs relevant to the incident.

2.4. Access to PHI:

• Business Associate shall make available PHI in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual, as necessary to satisfy Covered Entity's obligations under 45 CFR 164.524.
• Business Associate shall make PHI available for amendment and incorporate any amendments to PHI as directed by Covered Entity, as necessary to satisfy Covered Entity's obligations under 45 CFR 164.526.
• Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity's compliance with HIPAA.

2.5. Accounting of Disclosures:

• Business Associate shall maintain and make available information required to provide an accounting of disclosures as necessary to satisfy Covered Entity's obligations under 45 CFR 164.528.

3.1. Covered Entity shall:

• Notify Business Associate of any limitations in the Notice of Privacy Practices of Covered Entity that may affect Business Associate's use or disclosure of PHI.
• Notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose their PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI.
• Notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI.
• Not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity.
• Determine the content of every patient form it publishes or sends, including forms started from a template in the Services' library, and be responsible for the lawfulness of each question and of the consent or authorization wording, including, where a form is used as an authorization, the requirements of 45 CFR 164.508, and any consent required by 42 CFR Part 2 or by state law for minors or sensitive services.
• Not use the patient forms feature to collect payment card numbers, card verification codes, PINs or other cardholder or sensitive authentication data within the meaning of the PCI Data Security Standard. Business Associate may require Covered Entity to change a form that does so and to delete the affected responses, and may archive the form after notice where necessary to protect Individuals or the Services.
• Review patient form responses and flags in a timely way and provide any clinical follow-up, including on any answer indicating thoughts of self-harm. Scores and flags are review aids, not diagnoses. Business Associate does not monitor responses or provide an emergency or crisis service.

4.1. Technical Safeguards:

• Encryption at rest for stored files, patient form content and backup storage
• TLS 1.2+ encryption for data in transit
• Encryption (AES-256) of audio that the Transcribe Health Medical Scribe Chrome extension holds on the user's device while waiting to upload, under a key held only in the browser's session memory; upload is protected by TLS
• Role-based access controls (RBAC)
• Multi-factor authentication, enforceable by Covered Entity for all its users
• Automated session timeout, including an inactivity timeout in the Chrome extension
• Audit logging of access through the Services and administrative tools, including a tamper-evident audit log generated by the Chrome extension and mirrored to Business Associate's server-side audit log

4.2. Physical Safeguards:

• Production servers, owned by Business Associate or its owner, are kept in a locked room or cabinet at a single site in Ontario, Canada, with physical access limited to the Security Officer
• Physical security and power-protection measures at the site
• Stored files and backup storage encrypted at rest
• Backups kept on a separate backup server at the same site, with 30-day write-once retention
• Google Cloud Vertex AI, used for AI inference only, relies on the physical safeguards of Google's data centers, which Google has independently audited (SOC 2 Type II, ISO 27001)

4.3. Administrative Safeguards:

• Security awareness and HIPAA training scheduled in the compliance calendar
• Documented security policies and procedures
• Regular risk assessments
• Incident response procedures
• Business continuity and disaster recovery plans

4.4. Data Handling:

• By default, the platform automatically deletes audio recordings 90 days after transcription and deletes transcript and session records after 7 years. These are default settings, not retention periods required by law. Covered Entity may enable an optional automatic retention policy, configurable from 1 to 24 hours or from 1 to 30 days and disabled by default, to purge sessions, audio recordings, transcriptions, and generated documents earlier. PHI is also deleted on Covered Entity request or account closure, subject to the termination provisions of Section 5.3.
• PHI is stored with organization-level separation enforced by the application; stored files and backups are encrypted at rest
• Multi-tenant architecture: customers share the underlying database, separated by access checks in the application
• Access to PHI is logged and auditable; audit logs are retained for at least six (6) years to satisfy HIPAA Security Rule documentation requirements (45 CFR 164.312(b) and 164.530(j))
• AI providers process PHI only under a Business Associate Agreement with Business Associate, only to produce the requested output, and are contractually barred from training their models on it. Google Cloud Vertex AI never writes a request to storage; it may hold it in memory to speed up later requests and deletes it within 24 hours. Anthropic processes requests under its standard commercial terms: it deletes a request and its output within 30 days, but may keep them longer where the law requires it or to enforce its usage policy (a request its automated safety systems flag may be kept for up to 2 years), and it may hold a processed form of a request in memory to speed up later responses, deleting it 5 minutes after the last request that used it
• Browser-extension audio handling is within the scope of Business Associate's permitted uses and safeguards under this BAA. Where Covered Entity's Authorized Users install the Transcribe Health Medical Scribe Chrome extension, ePHI audio is captured in the browser, encrypted on the device while it waits to upload, and transmitted over an encrypted (TLS) connection to Business Associate's Canadian backend. Audio held on the user's device is deleted once upload is confirmed and, if it has not uploaded, no more than 72 hours after it was recorded; it can be decrypted only after the same user signs in again in that browser profile. The Extension introduces no new subcontractor and routes only to Business Associate's existing backend and previously disclosed Sub-processors.
• Patient forms handling is within the scope of Business Associate's permitted uses and safeguards under this BAA. A patient must confirm their date of birth before any form is shown, and repeated failures lock the link. Answers, drafts, signer names, drawn signatures and completed PDFs are encrypted at rest under an organization-specific key. Form link messages contain no PHI beyond the practice name and the link. Unsubmitted drafts are deleted 30 days after the link expires or is cancelled. Submitted responses are kept with the patient's record until Covered Entity deletes the patient or this BAA ends, subject to Section 5.3. On deletion of a patient, answers, drafts and completed PDFs are deleted and signature records keep only what proves consent was given. Answers and scores of a visit-linked form are included in the context used to generate that visit's clinical documentation, through the same previously disclosed subcontractors and under the same AI-provider terms described in this Section 4.4. The feature introduces no new subcontractor. Access to, views of and exports of responses are logged and auditable without recording response content.

4.5. Audit Rights and Assurance:

• Business Associate designs and operates its security controls to the AICPA SOC 2 Trust Services Criteria and is preparing for a SOC 2 Type II examination. Once the report is issued, upon Covered Entity's reasonable written request, no more than once per twelve (12) month period, Business Associate shall make its then-current SOC 2 Type II report available under a mutual non-disclosure agreement, together with a summary of any remediation of exceptions noted therein.
• Once issued, the SOC 2 Type II report shall be deemed to satisfy Covered Entity's audit and assessment rights under this BAA with respect to the controls within its scope.
• Covered Entity may conduct an on-site or remote audit of Business Associate's PHI-relevant controls in lieu of, or in addition to, the report only (i) following a Breach affecting Covered Entity's PHI, or (ii) following identification of a material control deficiency, on at least thirty (30) days' prior written notice, during normal business hours, no more than once per calendar year absent a subsequent Breach, in a manner that does not unreasonably disrupt operations or compromise other customers' data, subject to the confidentiality obligations of this BAA and the Terms of Service.

5.1.

• This BAA shall be effective upon acceptance by Covered Entity and shall remain in effect until the earlier of: termination of the underlying Terms of Service, or termination of this BAA by either party.

5.2.

• Either party may terminate this BAA if the other party materially breaches this BAA and fails to cure the breach within 30 days of receiving written notice of the breach.

5.3. Upon termination:

• Business Associate shall, at Covered Entity's election, return (machine-readable) or destroy all PHI to the extent feasible. Destruction from active systems within thirty (30) days, from backup systems within ninety (90) days, consistent with Business Associate's Data Retention and Disposal Policy.
• On completion, Business Associate shall provide written certification, including confirmation that subcontractors completed their destruction obligations.
• Return or destruction is "not feasible" only where, and for so long as, PHI resides in immutable, encrypted backup media subject to a bounded, automatically expiring retention cycle from which selective deletion is not technically practicable, or where PHI is subject to a legal hold or a record-retention obligation that the law imposes on Business Associate itself. Where not feasible, Business Associate shall extend the protections of this BAA to such PHI, limit further uses/disclosures to the purposes that make destruction infeasible, and destroy the residual PHI upon expiry of the applicable backup-retention cycle or legal hold.

6.1. In addition to HIPAA requirements, Business Associate acknowledges and complies with:

• The Personal Information Protection and Electronic Documents Act (PIPEDA)
• Applicable provincial privacy and health-privacy legislation, including PHIPA (Ontario), the Health Information Act (HIA, Alberta), the Personal Information Protection Act (PIPA, Alberta), the Act respecting the protection of personal information in the private sector as amended by Law 25 (Quebec), the Personal Information Protection Act (PIPA, British Columbia), and other provincial privacy legislation as applicable.
• Cross-border data transfer requirements under Canadian federal and provincial law

7.1. Regulatory References:

• Any reference in this BAA to a section in HIPAA means the section as in effect or as amended.

7.2. Amendment:

• The parties agree to take such action as is necessary to amend this BAA from time to time as is necessary for compliance with HIPAA and the HITECH Act.

7.3. Survival:

• The respective rights and obligations of Business Associate under Sections 5.3, 7.6, and 7.7 of this BAA shall survive the termination of this BAA.

7.4. Interpretation:

• Any ambiguity in this BAA shall be interpreted to permit compliance with HIPAA.

7.5. Governing Law:

• This BAA shall be governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable therein.

7.6. Limitation of Liability:

• The Limitation of Liability set forth in the Terms of Service applies to this BAA and to all claims arising out of or relating to the use, disclosure, or safeguarding of PHI. The parties do not establish any supercap or enhanced liability for PHI or Security-Rule claims; such claims are subject to the same Limitation of Liability as all other claims under the Terms of Service, except for any liability that cannot be limited under applicable law.

7.7. Insurance:

• Business Associate is in the process of procuring cyber-liability and technology errors-and-omissions insurance appropriate to the nature and scale of its Services and intends to maintain such coverage. Once such coverage is in force, Business Associate shall, upon Covered Entity's reasonable written request, provide a certificate of insurance evidencing it.