OrthoDocs Master Business Associate Agreement

This OrthoDocs Master Business Associate Agreement (this "BAA") is entered into by and between Acqwired Inc., a Nevada corporation with its principal place of business at 899 Tahoe Blvd, STE 500, Incline Village, NV 89451 ("Acqwired" or "Business Associate"), and the healthcare provider, professional practice, professional entity, or other organization on whose behalf this BAA is accepted ("Covered Entity").

Acqwired provides the OrthoDocs software platform and related services ("OrthoDocs" or the "Services").

This BAA becomes effective on the date it is electronically accepted by an authorized representative of Covered Entity or, if separately executed or incorporated into another written agreement between the Parties, on the effective date specified therein (the "Effective Date").

By electronically accepting this BAA on behalf of an organization, the individual accepting represents and warrants that the individual has authority to bind that organization to this BAA.

Covered Entity and Business Associate may each be referred to as a "Party" and collectively as the "Parties."

1. Purpose and Scope

Covered Entity uses the Services to facilitate the receipt, management, coordination, and processing of patient referrals, consultations, scheduling, communications, and related healthcare workflows.

In connection with the Services, Business Associate may create, receive, maintain, or transmit Protected Health Information on behalf of Covered Entity.

The Parties enter into this BAA to satisfy the applicable requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and their implementing regulations, as amended from time to time.

This BAA applies to all PHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity in connection with the Services, regardless of the individual authorized user, user account, method of submission, or means by which such PHI is entered into, received by, maintained within, accessed through, or transmitted through the Services.

Accordingly, once this BAA is effective between Covered Entity and Business Associate, it applies to PHI handled through the Services on behalf of Covered Entity by or through Covered Entity's authorized users without requiring a separate BAA for each individual user, patient, referral, login, or transaction.

2. Definitions

Capitalized terms not otherwise defined in this BAA shall have the meanings assigned to them under the HIPAA Rules.

"Breach" has the meaning set forth in 45 C.F.R. § 164.402.

"Designated Record Set" has the meaning set forth in 45 C.F.R. § 164.501.

"Electronic Protected Health Information" or "ePHI" has the meaning set forth in 45 C.F.R. § 160.103.

"HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164, as amended from time to time.

"Individual" has the meaning set forth in 45 C.F.R. § 160.103.

"Protected Health Information" or "PHI" has the meaning set forth in 45 C.F.R. § 160.103 and, for purposes of this BAA, is limited to PHI created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity.

"Required By Law," "Secretary," "Security Incident," "Subcontractor," "Unsecured Protected Health Information," "Use," and "Disclosure" have the meanings assigned to those terms under the HIPAA Rules.

3. Permitted Uses and Disclosures of PHI

3.1 Provision of the Services

Business Associate may Use and Disclose PHI as reasonably necessary to provide, operate, secure, support, and maintain the Services for Covered Entity, or as otherwise permitted by this BAA or Required By Law.

Such activities may include:

1. receiving and processing patient referral information;
2. hosting, storing, organizing, maintaining, transmitting, and displaying referral and patient information;
3. making PHI available to users authorized by Covered Entity;
4. facilitating referral coordination, consultation scheduling, and related patient-care workflows;
5. facilitating communications authorized by Covered Entity in connection with referrals, consultations, scheduling, and related patient-care workflows;
6. providing technical support, troubleshooting, security, backup, disaster recovery, maintenance, and administration of the Services; and
7. performing other activities requested or authorized by Covered Entity that are permitted under the HIPAA Rules.

3.2 Limitations on Use and Disclosure

Business Associate shall not Use or Disclose PHI except as permitted or required by this BAA or as Required By Law.

Business Associate shall not Use or Disclose PHI in a manner that would violate the HIPAA Rules if performed by Covered Entity, except to the extent the HIPAA Rules expressly permit such Use or Disclosure by a Business Associate.

Business Associate shall not sell PHI.

Business Associate shall not Use PHI for third-party advertising or marketing except where expressly authorized by Covered Entity and permitted by applicable law.

Business Associate shall not Use Covered Entity's PHI to train generalized artificial-intelligence or machine-learning models for the benefit of Business Associate or third parties unless Covered Entity separately and expressly authorizes such Use in writing and such Use is permitted by applicable law.

3.3 De-Identification

Business Associate shall not de-identify PHI received from or on behalf of Covered Entity for Business Associate's independent commercial purposes unless Covered Entity separately authorizes such activity in writing and the de-identification and subsequent Use or Disclosure are permitted under applicable law.

Nothing in this Section prohibits Business Associate from performing technical processing necessary to provide the Services or from generating information that does not constitute PHI and cannot reasonably be used to identify an Individual, to the extent permitted by applicable law.

3.4 Management and Administration

Business Associate may Use PHI as necessary for the proper management and administration of Business Associate or to carry out its legal responsibilities, as permitted by the HIPAA Rules.

Business Associate may Disclose PHI for such purposes only if the Disclosure is Required By Law or Business Associate obtains reasonable assurances from the recipient that the PHI will remain confidential, will be Used or further Disclosed only as Required By Law or for the purpose for which it was disclosed, and the recipient will notify Business Associate of any breach of confidentiality of which it becomes aware.

3.5 Minimum Necessary

To the extent required by the HIPAA Rules, Business Associate shall make reasonable efforts to limit its Uses, Disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose.

4. Obligations of Business Associate

4.1 Safeguards and Security Rule Compliance

Business Associate shall use appropriate administrative, physical, and technical safeguards to prevent the Use or Disclosure of PHI other than as permitted by this BAA.

With respect to ePHI, Business Associate shall comply with the applicable requirements of the HIPAA Security Rule set forth at 45 C.F.R. Part 164, Subpart C.

4.2 Unauthorized Uses and Disclosures

Business Associate shall report to Covered Entity any Use or Disclosure of PHI not permitted by this BAA of which Business Associate becomes aware.

4.3 Breach Notification

Following discovery of a Breach of Unsecured Protected Health Information, Business Associate shall notify Covered Entity without unreasonable delay and in no event later than sixty (60) calendar days following discovery, in accordance with 45 C.F.R. § 164.410.

To the extent known and available to Business Associate, such notification shall include:

1. identification of each Individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, Used, or Disclosed;
2. a description of the nature and circumstances of the Breach;
3. the types of PHI involved;
4. the date of the Breach, if known, and the date of its discovery;
5. information reasonably available to assist Covered Entity in fulfilling its notification obligations under applicable law; and
6. corrective or mitigating measures taken or proposed by Business Associate.

Business Associate may supplement its notification as additional relevant information becomes available.

4.4 Security Incidents

Business Associate shall report Security Incidents to Covered Entity as required by the HIPAA Rules.

The Parties acknowledge that unsuccessful attempts to access, Use, Disclose, modify, or destroy information or interfere with system operations routinely occur in connection with Internet-connected information systems. Such events may include unsuccessful login attempts, network scans, pings, probes, automated attacks, and similar unsuccessful activities.

This BAA constitutes notice to Covered Entity of such routine unsuccessful Security Incidents, and Business Associate shall not be required to provide separate notice of each such event unless the event results in unauthorized access, Use, Disclosure, modification, or destruction of PHI or otherwise requires individual notification under the HIPAA Rules or other applicable law.

4.5 Mitigation

To the extent practicable, Business Associate shall mitigate any harmful effect known to Business Associate resulting from a Use or Disclosure of PHI by Business Associate in violation of this BAA.

4.6 Subcontractors

Business Associate shall ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to restrictions, conditions, and requirements concerning such PHI that satisfy applicable requirements of the HIPAA Rules.

Business Associate shall take reasonable steps to cure or end a material breach or violation by such a Subcontractor of its applicable obligations and, if such steps are unsuccessful, terminate the applicable arrangement if feasible, as required by the HIPAA Rules.

4.7 Access to PHI

To the extent Business Associate maintains PHI in a Designated Record Set on behalf of Covered Entity, Business Associate shall make such PHI available to Covered Entity as reasonably necessary for Covered Entity to satisfy its obligations under 45 C.F.R. § 164.524.

If Business Associate receives a request for access directly from an Individual relating to PHI maintained on behalf of Covered Entity, Business Associate may refer the Individual to Covered Entity unless Business Associate has been expressly delegated responsibility for responding to such requests.

4.8 Amendment

To the extent Business Associate maintains PHI in a Designated Record Set on behalf of Covered Entity, Business Associate shall make PHI available for amendment and incorporate amendments as directed or agreed to by Covered Entity as reasonably necessary for Covered Entity to satisfy its obligations under 45 C.F.R. § 164.526.

If Business Associate receives a request for amendment directly from an Individual, Business Associate may refer the Individual to Covered Entity unless Business Associate has been expressly delegated responsibility for responding to such requests.

4.9 Accounting of Disclosures

Business Associate shall maintain and make available information concerning Disclosures of PHI as reasonably necessary for Covered Entity to satisfy its obligations under 45 C.F.R. § 164.528.

If Business Associate receives a request for an accounting directly from an Individual, Business Associate may refer the Individual to Covered Entity unless Business Associate has been expressly delegated responsibility for responding to such requests.

4.10 Access by the Secretary

Business Associate shall make its internal practices, books, and records relating to the Use and Disclosure of PHI received from, or created, received, maintained, or transmitted on behalf of Covered Entity available to the Secretary for purposes of determining compliance with the HIPAA Rules.

4.11 Delegated Privacy Rule Obligations

To the extent Business Associate is expressly delegated responsibility for carrying out any obligation of Covered Entity under the HIPAA Privacy Rule, Business Associate shall comply with the requirements of the Privacy Rule applicable to Covered Entity in performing that obligation.

5. Obligations of Covered Entity

Covered Entity shall:

1. use the Services in accordance with applicable law;
2. notify Business Associate of any limitation in Covered Entity's Notice of Privacy Practices that may affect Business Associate's Use or Disclosure of PHI;
3. notify Business Associate of any change in, or revocation of, an Individual's authorization or permission to Use or Disclose PHI to the extent such change may affect Business Associate's Use or Disclosure of PHI;
4. notify Business Associate of any restriction on the Use or Disclosure of PHI to which Covered Entity has agreed or with which Covered Entity is required to comply under 45 C.F.R. § 164.522, to the extent such restriction may affect Business Associate;
5. not request Business Associate to Use or Disclose PHI in a manner that would violate the HIPAA Rules if performed by Covered Entity, except to the extent expressly permitted under the HIPAA Rules;
6. determine which members of its workforce and other users are authorized to access PHI through the Services;
7. maintain appropriate controls over its user accounts, credentials, devices, and personnel;
8. promptly terminate or modify access when an individual's authorization to access the Services on behalf of Covered Entity terminates or changes; and
9. be responsible for the accuracy, legality, and appropriateness of PHI and other information submitted to the Services by or on behalf of Covered Entity, including ensuring that Covered Entity has any authorization or other legal basis required for the applicable Use or Disclosure.

6. Authorized Users

Covered Entity may permit its workforce members and other appropriately authorized persons to access and use the Services on its behalf.

PHI created, received, maintained, or transmitted through the Services in connection with such authorized use shall be governed by this BAA.

Covered Entity is responsible for determining who is authorized to use the Services on its behalf and for promptly revoking or modifying such authorization when appropriate.

An individual authorized user is not required to separately execute this BAA solely by reason of accessing or using the Services on behalf of Covered Entity.

Nothing in this Section limits Business Associate's obligations to protect PHI under this BAA.

7. Third-Party Service Providers and Subcontractors

Business Associate may use third-party infrastructure, hosting, communications, security, support, and other service providers in connection with the Services.

To the extent a third-party provider creates, receives, maintains, or transmits PHI on behalf of Business Associate and constitutes a Business Associate Subcontractor under HIPAA, Business Associate shall enter into an appropriate written agreement with such provider satisfying applicable requirements of the HIPAA Rules before permitting the provider to handle PHI.

Business Associate shall remain responsible for complying with its obligations under this BAA notwithstanding its use of Subcontractors.

8. Term and Termination

8.1 Term

This BAA becomes effective on the Effective Date and remains in effect for so long as Business Associate creates, receives, maintains, or transmits PHI on behalf of Covered Entity in connection with the Services, unless terminated in accordance with this BAA.

8.2 Termination for Cause

If Covered Entity determines that Business Associate has violated a material term of this BAA, Covered Entity may provide Business Associate a reasonable opportunity to cure the violation or end the offending practice.

If Business Associate fails to cure or end the violation within the applicable period, or if cure is not feasible, Covered Entity may terminate this BAA and the applicable Services Agreement if feasible.

Nothing in this Section limits either Party's obligations under the HIPAA Rules concerning known material breaches or violations by a Business Associate or Subcontractor.

8.3 Effect of Termination; Return or Destruction of PHI

Upon termination of this BAA or the Services, Business Associate shall, if feasible, return to Covered Entity or destroy PHI received from, or created, received, maintained, or transmitted on behalf of Covered Entity that Business Associate continues to maintain.

Business Associate may retain PHI to the extent necessary for its proper management and administration, to carry out its legal responsibilities, or where return or destruction is infeasible, to the extent permitted by applicable law.

For any PHI retained following termination, Business Associate shall:

1. continue to extend the protections of this BAA to such PHI;
2. limit further Uses and Disclosures to the purposes for which retention is permitted or that make return or destruction infeasible;
3. continue to comply with applicable Security Rule requirements for ePHI; and
4. return or destroy retained PHI when it is no longer necessary to retain it and return or destruction becomes feasible.

PHI may remain for a limited period in secure backups, disaster-recovery systems, security logs, or other systems from which immediate deletion is not reasonably feasible. Business Associate shall continue to protect such PHI pursuant to this BAA and shall not Use or Disclose such PHI except as permitted by this Section or applicable law.

8.4 Survival

Business Associate's obligations under Section 8.3 shall survive termination of this BAA for so long as Business Associate maintains PHI subject to this BAA.

9. Electronic Acceptance and Evidence of Agreement

Covered Entity may enter into this BAA electronically.

An individual accepting this BAA on behalf of Covered Entity represents and warrants that the individual has authority to bind Covered Entity to this BAA.

Electronic acceptance of this BAA shall have the same force and effect as execution of a written counterpart to the extent permitted by applicable law.

Business Associate may maintain records reasonably necessary to establish the existence and terms of the agreement between the Parties, including:

1. Covered Entity's legal name;
2. the identity and contact information of the individual accepting the BAA;
3. the individual's title or role;
4. the individual's representation of authority to bind Covered Entity;
5. the date and time of acceptance;
6. the version of this BAA accepted;
7. electronic records associated with the acceptance, which may include user-account information, IP address, or similar audit information; and
8. an archived copy or cryptographic hash of the version of this BAA accepted.

Such records may be maintained electronically.

10. Separately Executed Business Associate Agreements

Covered Entity or Business Associate may request that the Parties enter into a separately executed Business Associate Agreement.

If Covered Entity and Business Associate enter into a separately negotiated and executed Business Associate Agreement expressly governing the same Services and PHI, that separately executed agreement shall supersede this Master BAA with respect to the subject matter covered by that agreement for so long as such agreement remains effective.

The existence of this Master BAA does not prevent the Parties from executing a separate BAA or amendment.

11. Relationship to Services Agreement

This BAA supplements and is incorporated into any Terms of Service, subscription agreement, order form, services agreement, or other agreement governing Covered Entity's use of the Services (collectively, the "Services Agreement").

In the event of a conflict between this BAA and the Services Agreement concerning the privacy, security, Use, or Disclosure of PHI, this BAA shall control with respect to such subject matter.

Except as expressly provided herein, this BAA does not modify the commercial terms, fees, warranties, limitations of liability, indemnification obligations, dispute-resolution provisions, or other provisions of the Services Agreement.

12. Changes to this BAA

Business Associate may amend this BAA as reasonably necessary to comply with changes to HIPAA, HITECH, their implementing regulations, or other applicable law.

No amendment shall retroactively authorize a Use or Disclosure of PHI that was prohibited when such Use or Disclosure occurred.

Where affirmative acceptance of an amended BAA is required by applicable law or the Parties' contractual relationship, Business Associate shall obtain such acceptance before the amended BAA becomes effective with respect to Covered Entity.

Business Associate shall maintain or make available the then-current version of this BAA through the Services or its website.

13. Regulatory References

A reference in this BAA to a provision of HIPAA, HITECH, or the HIPAA Rules means that provision as in effect or as subsequently amended, superseded, or replaced.

14. Interpretation

Any ambiguity in this BAA shall be interpreted to permit the Parties to comply with the HIPAA Rules.

Nothing in this BAA authorizes Business Associate to Use or Disclose PHI in a manner prohibited by applicable law.

15. No Third-Party Beneficiaries

Nothing in this BAA is intended to confer any rights or remedies upon any person or entity other than Covered Entity and Business Associate.

16. Entire Agreement Regarding PHI

Except for a separately executed Business Associate Agreement pursuant to Section 10, this BAA, together with applicable provisions of the Services Agreement, constitutes the agreement between the Parties concerning Business Associate's Use and Disclosure of PHI in connection with the Services and supersedes prior inconsistent agreements between the Parties concerning such subject matter.

Business Associate

Electronic Acceptance by Covered Entity

By electronically accepting this BAA, the individual accepting:

1. identifies the organization entered during registration or account administration as the Covered Entity for purposes of this BAA;
2. represents and warrants that the individual is authorized to bind that Covered Entity;
3. acknowledges that the Covered Entity has had an opportunity to review this BAA; and
4. agrees to this BAA on behalf of the Covered Entity.

Covered Entity

Recorded automatically at acceptance

Accepted by

Recorded automatically at acceptance

Title / role

Recorded automatically at acceptance

Date and time

Recorded automatically at acceptance

BAA version

Recorded automatically at acceptance

Acceptance record

Maintained electronically by Acqwired, Inc.

Questions

Questions regarding this BAA may be directed to:

To request a separately executed Business Associate Agreement under Section 10, or to ask about how OrthoDocs handles PHI, get in touch with our team.